The threat actor behind the GhostAction supply chain attack expanded their tactics by injecting a credential stealer disguised as a fake font file into 94 GitHub repositories.
The vulnerability or weakness
The vulnerability arose from the use of malicious GitHub Actions workflows, which were initially compromised and later used to deliver the credential stealer.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations could face significant risks, including data breaches and loss of sensitive information, as attackers can now gain unauthorized access to repositories and workflows.
Industries affected
Tech and software development firms are particularly at risk due to their reliance on open-source tools and GitHub.
Users affected
Open-source developers and maintainers may have their credentials stolen, leading to potential unauthorized access to their accounts and projects.
